SPF, part 3: configuring Postfix to check SPF records when receiving mail

(for extra fun, read parts 1 and 2 first.)

Now that you know how to configure an SPF record for your domain(s), the natural next step, if you administer an email server, is to start checking SPF records for mails you receive.

Now, spammers are infamous for not respecting rules, not “playing nice”, so, you might ask, what makes me think they’ll set up SPF records for their domains, which would be kind of self-defeating? The obvious answer is that SPF doesn’t depend on the spammers’ collaboration. Since legitimate email senders use SPF to tell the world which servers they use to send email, it prevents others — such as the aforementioned spammers — from faking sender addresses to pretend they’re from those senders / domains.

To put it simply: if there’s an SPF record for the “gmail.com” domain, then you can — and should — reject mail purporting to be from something@gmail.com that doesn’t come from the servers listed in that record. In other words, anyone who fakes a @gmail.com address can’t fool your server, assuming you have it configured to use SPF.

Now, how to do that? There are many ways, of course, depending on the email server you use. The simple recipe below uses postfix-policyd-spf-perl to make Postfix reject mail from domains with properly configured SPF records, when the mail comes from an unauthorized server (that is, one not listed on the record.) This assumes you already have Postfix up and running.

  • install postfix-policyd-spf-perl. In Ubuntu, just do an apt-get install postfix-policyd-spf-perl .
  • add this line to /etc/postfix/main.cf:
    spf-policyd_time_limit = 3600s
  • add the following to /etc/postfix/master.cf:
    policy-spf  unix  -       n       n       -       -       spawn
         user=nobody argv=/usr/bin/policyd-spf

    (change the path of policyd-spf if it’s installed somewhere else; that’s where the Ubuntu package puts it.)

  • in /etc/postfix/main.cf, find the smtpd_recipient_restrictions section, and, immediately after permit_mynetworks (and permit_sasl_authenticated, if you’re using that), add:
    check_policy_service unix:private/policy-spf
  • restart Postfix. Check your logs to see if everything is working properly.

Now, remember when in part 2 I mentioned a lesser-known reason for configuring the SPF record for your domain? It’s this: it’ll stop a lot of incoming spam. These days, a lot of spam email pretends to be from you (that is, it uses your email address as both the “From:” and “To:”), or at least from your domain (e.g. administrator@yourdomain, manager@yourdomain, and so on.) I don’t know why spammers do that, but apparently it works, or else they wouldn’t do it (maybe victims get confused and think the email comes from someone in their company, or maybe webmail services tend — or at least did so once — to trust the user’s own address, I don’t know.) Well, if you have SPF for your domain and your email server checks SPF records for incoming mail, then spam messages such as these will be always rejected, even when other methods of stopping spam (RBL lists, SpamAssassin, etc.) fail. Never again will you receive emails pretending to be from your own address.

Related posts:

  1. SPF, part 1: what is SPF, and how to fight spam with it
  2. SPF, part 2: how to configure SPF for a domain
  3. An Anti-Spam gateway #4: Postfix, part 2
  4. An Anti-Spam gateway #3: Postfix
  5. An Anti-Spam gateway #11: amavisd-new and Postfix

Tags: , , ,

28 Responses to “SPF, part 3: configuring Postfix to check SPF records when receiving mail”

  1. Hello! I simply would like to give an enormous thumbs up
    for the nice information you may have right here on this post.
    I might be coming back to your blog for extra soon.

  2. supplements says:

    We’re a bunch of volunteers and starting a new scheme in our community. Your web site offered us with helpful information to work on. You have performed a formidable job and our entire group shall be thankful to you.

  3. I read this piece of writing completely on the topic of the difference of newest and previous technologies, it’s remarkable article.

    Also visit my website: windows 8.1 kms

  4. ӏn the event the grass is really hard, you aгe able to
    make use of a ρickax to help crack іt up.
    As soon as you’ve got taken off all the grass, you’ll be able to more usе the pickax to interrupt
    up all the large clumps. After you’ve got got almоst all of the big tough stuff broken up, it is ρossible
    tо movе ahead to employing the backyard garden hoe.

    A yard hoe has a modest plate on the finish that yоu
    simply can use to cut up your soіl and filth.

    Also visіt my homepage best garden tillеr (besttiller.com)

  5. Very nice post. I just stumbled upon your weblog and wished to say that I’ve really enjoyed surfing around your blog posts.

    After all I’ll be subscribing to your feed and I hope you write again very soon!

  6. Howdy very nice web site!! Guy .. Excellent .. Superb ..

    I will bookmark your website and take the feeds also?
    I am glad to search out so many useful information here within the submit, we want develop
    more techniques on this regard, thank you for sharing.
    . . . . .

  7. Very nice post. I just stumbled upon your weblog and wished to say that I’ve really enjoyed surfing around your blog posts.
    I read this piece of writing completely on the topic of the difference of newest and previous technologies, it’s remarkable article.
    thank you so much

  8. I am glad to search out so many useful information here within the submit, we want develop

  9. We’re a bunch of volunteers and starting a new scheme in our community. Your web site offered us with helpful information to work on. You have performed a formidable job and our entire group shall be thankful to you.

  10. this remained a popular school of thoughtEen recente bevinding suggereerde zelfs dat maar liefst acht drankjes in een week, en tot vijf in een vergadering, mag geen significante effecten .. Sergei Fedorov en Steve Yzerman en Brendan Shanahan en de hele lijst van toekomstige (nu lopende) Hall of hebben Famers kon vertrekken of met pensioen gaan en het maakte niet omdat Detroit had Pavel Datsyuk en Henrik Zetterberg wachten in de coulissen.. Als het genoemd, moet in context dat de gegevens niet we

  11. Сокращения на веб-сайтах также предоставили след, войти в контакт с к поло рознично&#1

  12. Læs mere Mick Jagger først sang en træk det bliver gammel, han var 23 år gammel. Nu på 69, han er stadig en veritabel Jumpin Jack Flash på scenen.. Er en helt ny måde at tænke på batterier, sagde kongen. Batteriet kan levere langt mere magt end nogen nogensinde troede. Udenlandske tog hundred spørgsmålstegn pro forex robot udsolgt Legolas for havde markedet hviskede i handel øre. Nå off please, hvad er det, men der kløft ser e

  13. Zhang is the director of openning ceremony. Exactly why he was chosen is the fact that he was found by the organizing committee is the most widely known Chinese director. A vice president of organizing committee said he is the sole Chinese director who can raise enough money to fund shooting whenever he opens mouth with a brand new idea. No second Chinese director can perform this.I am, I know, either being deceived, like a baby, by my own fears, Cheap Fake Nike Heels otherwise I am in desperate

  14. city gate says:

    Everything is very open with a very clear clarification of the issues.

    It was truly informative. Your site is extremely helpful.
    Thank you for sharing!

  15. I hope whoever Nike Roshe Run Australia reads the article will be inspired. Many may have the dream that you had that you simply achieved but until and unless they strive on their dreams they’ll/can never achieve it. I’ve been leaning toward an AJAX style editor using a tree or combobox that has checkboxes to show what is being published, and permit files to be moved between folders; public folders could be linked manually into the static site. I don’t need a huge portal, just a minimum. From pr

  16. My ženy prišla z tohto dôvodu veľmi zaujíma čítať všetky z nich a už v skutočnosti bolo s potešením v týchto veciach. Zrovnávače. A niekedy členovia virtuálne komunity zdravotné stačí spustiť svoje vlastné verzie klinických štúdiách. Má dlhé internet vyšetrovanie nakoniec bol poctený s kvalitným skutočností a techník zdie&#

  17. Si vous voulez un mariage jardin extérieur, hôtels de Las Vegas offrent beaucoup de lieux de mariage de jardin à choisir. L’Hôtel Flamingo offre cinq emplacements de jardin en plein air, dont deux qui ont gazebos et deux qui présentent des cascades à couper le souffle. Caesars Palace propose trois sites de mariage en plein air dont une qui comprend un étang et fontaines. Il ya quelques années il ya eu une enquête faite que les Timberland Pas Cher gens

  18. This is really interesting, You’re a very skilled blogger.
    I have joined your rss feed and look forward to seeking more of your magnificent post.
    Also, I’ve shared your site in my social networks!

  19. marketing says:

    Hello there! I could have sworn I’ve been to this website before but after reading through
    some of the post I realized it’s new to me. Nonetheless, I’m definitely glad I found it and I’ll be
    bookmarking and checking back frequently!

  20. Las versiones revisadas son leídos y comentados por sus pares. La lista de los 2018 vendedores proyectado incluye tratamientos que van desde Roche Rituxan, un megablockbuster siendo perseguido por los productores biosimilares que han contraído en el atractivo para el mercado, a las Nike Air Max Baratas terapias como Soliris de Alexion y Kalydeco de Vertex, cuyos fabricantes están tratando de ampliar el pequeño paciente poblaciones que las mantienen a flote.. Los asientos tras

  21. Lela says:

    It’s hard to find your posts in google. I found it on 20 spot, you should
    build quality backlinks , it will help you to get more visitors.

    I know how to help you, just search in google – k2 seo
    tips

  22. Zgodnie z ich strony Ray Ban Wayfarer internetowej, w tym 4,1 mld dolarów projekt obejmuje kolejne zagrożenie dla Alberta i BC ludzi i środowiska poprzez zwiększenie transportu rurociągiem z 300.000 baryłek dziennie do 750 tysięcy baryłek dziennie. “Kinder Morgan Kanada proponuje zwiększenie pojemności istniejącego systemu rurociągów 1150 km pomiędzy Edmonton, Alberta i Burnaby, Kolumbia Brytyjska, w tym terminalu morskiego We

  23. bathroom renovations…

    SPF, part 3: configuring Postfix to check SPF records when receiving mail…

  24. Hi. Ik heb onlangs onderzoek deed over mensen die inbreken in andere webcams en controleren hun privacy bijvoorbeeld het veranderen van doeken of wat dan New Balance 574 Aanbieding ook. Het is niet dat hard.150m alleen wanneer alle exemplaren verkocht volledige retail en Sony kreeg 100% van het geld, maar dat is niet hoe het werkt Sony zou gelukkig zijn om New Balance Shoes Brussels een ​​derde van die money.So wat geld aftrekken zien. Ze zeiden dat het spel maakte 100 miljoen, niet

  25. Alasdair Green, Inspector for Construction, said:”This was the fifth year of the inspection initiative Cheap Nike Roshe Australia and it is disappointing to find construction sites using the same unnecessary risks using their workers’ lives. “Although there were examples of good practice, which the industry can study from, the fact that we found unsafe conditions on a single in four sites is unacceptable. I had been horrified, so I got from the water and x?g=posts&t=255997 wrapped a towel around

  26. Otra buena idea a tener en cuenta es conseguir una buena noche de sueño. La universidad abarca aproximadamente 420 acres (1,7 y 100 edificios. [10] El campus está situado cerca del extremo sur de la zona del centro de Arlington que contiene las oficinas del gobierno de la ciudad, así como la y la línea del ferrocarril pacífico que la ciudad fue originalmente establecida alrededor Bacterias coli en hasta 25% de los casos. A los niños les encanta, sin duda .. De hecho

  27. Il s’agit d’un tour de cou blanc et sourcil (ligne au-dessus de chaque œil). Les mâles et les femelles se ressemblent. Si nos écoles consacrent plus d’attention à l’importance de la synagogue comme un lieu pour l’identité juive et de la communauté, ce ne serait pas un problème. En outre, je suis d’accord que Tefila doit être une partie importante du programme.Les ensembles home TV préférées (HGTV) propose un éventail de spectacles peuv

  28. For Tums. “There was no way I could lay down to go to sleep without one. We have been aiming for the highest quality with our forums from their inception, and we believe that this excellence is truly tangible and treasured by our members. We’d enjoy having you join us today and convince yourself!. The fundamentals of your family budget might have changed in recent years. Families of all shapes and sizes have face unprecedented money struggles because the economy continues to slowly recover from

Leave a Reply

Notify me of followup comments via e-mail. You can also subscribe without commenting.


Creative Commons Attribution-NonCommercial-NoDerivs 2.5 Portugal
This work by Pedro Timóteo is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 2.5 Portugal.